A second vulnerability that can be exploited to modify Android apps without breaking their digital signatures has been identified and publicly documented.